Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2024-30078.
Upgrade to ProDetect CVE-2024-30078: Windows Wi-Fi Driver Remote Code Execution via Adjacent Network in Microsoft Sentinel
Detects exploitation attempts of CVE-2024-30078, a critical Windows Wi-Fi Driver vulnerability (CWE-591: Sensitive Data Storage in Improperly Locked Memory) that allows unauthenticated remote code execution from an adjacent network. An attacker within Wi-Fi range can send specially crafted network packets to trigger memory corruption in the Windows Wi-Fi driver (nwifi.sys), potentially gaining SYSTEM-level code execution without user interaction. Affected platforms include Windows 10, Windows 11, and Windows Server 2008 through 2022.
MITRE ATT&CK
KQL Detection Query
let timeWindow = 1h;
let suspiciousDriverEvents = DeviceEvents
| where Timestamp > ago(timeWindow)
| where ActionType in ("DriverLoad", "ServiceInstalled")
| where InitiatingProcessFileName =~ "nwifi.sys" or FileName =~ "nwifi.sys"
| project Timestamp, DeviceId, DeviceName, ActionType, FileName, InitiatingProcessFileName, InitiatingProcessCommandLine;
let wifiCrashEvents = DeviceEvents
| where Timestamp > ago(timeWindow)
| where ActionType == "ProcessCrashed" or ActionType == "KernelPanicDetected"
| where InitiatingProcessFileName has_any ("wlanext.exe", "nwifi.sys", "wlansvc.dll")
| project Timestamp, DeviceId, DeviceName, ActionType, InitiatingProcessFileName;
let unexpectedNetworkSpawn = DeviceProcessEvents
| where Timestamp > ago(timeWindow)
| where InitiatingProcessFileName =~ "svchost.exe"
| where InitiatingProcessCommandLine has "wlansvc"
| where FileName in~ ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe")
| project Timestamp, DeviceId, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName;
union suspiciousDriverEvents, wifiCrashEvents, unexpectedNetworkSpawn
| extend AlertReason = case(
ActionType == "DriverLoad" and FileName =~ "nwifi.sys", "Suspicious Wi-Fi driver reload",
ActionType == "ProcessCrashed" and InitiatingProcessFileName has "nwifi", "Wi-Fi driver crash - possible exploitation attempt",
FileName in~ ("cmd.exe", "powershell.exe"), "Unexpected shell spawned from Wi-Fi service context",
"Anomalous Wi-Fi driver activity"
)
| order by Timestamp descDetects suspicious Windows Wi-Fi driver activity indicative of CVE-2024-30078 exploitation: driver reloads, crashes in nwifi.sys context, and unexpected process spawning from the WLAN service (wlansvc). Combines DeviceEvents and DeviceProcessEvents to surface both kernel-level anomalies and post-exploitation lateral movement.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate Wi-Fi driver updates or reinstallations by IT administrators
- System administrators running diagnostic tools against wireless interfaces
- Antivirus or EDR products scanning nwifi.sys during scheduled scans
- Windows Update installing legitimate Wi-Fi driver patches
- Third-party wireless management software interacting with WLAN service
Other platforms for CVE-2024-30078
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate WLAN Service Child Process Spawn (Post-Exploitation Indicator)
Expected signal: Sysmon EventID 1 (Process Create) with ParentImage=svchost.exe, ParentCommandLine containing '-k wlansvc', Image=cmd.exe. MDE DeviceProcessEvents showing InitiatingProcessCommandLine with 'wlansvc'.
- Test 2Wi-Fi Driver Version Audit for Vulnerability Assessment
Expected signal: DeviceEvents with ActionType=FileRead on nwifi.sys path. PowerShell script block logging (EventID 4104) capturing the enumeration commands. WMI activity logs showing Win32_SystemDriver query.
- Test 3Adjacent Network Malformed 802.11 Frame Injection (Controlled Lab)
Expected signal: On the target Windows host: Windows Event Log System EventID 41 or 1001 (BugCheck/kernel crash) if exploitation succeeds. Network capture on the target side shows malformed 802.11 frames from attacker MAC. Defender/EDR may log driver fault events referencing nwifi.sys.
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2024-30078 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month